"The ANPD's new regulation on Data Protection Officers: Everything you need to know"

Brazil’s General Data Protection Law (LGPD – Lei Geral de Proteção de Dados Pessoais) introduced a figure which, although common internationally, had not existed in the Brazilian legal system: the data protection officer or DPO, known as the Encarregado in Portuguese.

Article 41 of the LGPD provides that all data controllers must appoint a Data Protection Officer, and the DPO’s name and contact information must be made available to the public, preferably on the controller’s website.

The legislation, however, did not provide further details on the role of DPOs. Instead, it gave the National Data Protection Authority (ANPD – Autoridade Nacional de Proteção de Dados) powers to issue supplementary rules on the definition and duties of Data Protection Officers, and to specify the cases in which appointment of a DPO is not required.

On July 17, 2024, ANPD’s Resolution 18 was published in the Federal Official Gazette, approving the Data Protection Officer Regulation, which sets out new rules on the function of DPOs.

This booklet, in Q&A format, is designed to provide you with the essential information you need to know about the role of Data Protection Officers in Brazil.

If you have any questions or need help on this topic, our Data Privacy and Cybersecurity team is at your disposal.